Type Juggling in PHP Switch - Juggling Facts [HackTheBoo CTF 2022]

preview_player
Показать описание
Type juggling is a really interesting PHP vulerability that happens when a developer uses == to compare two items that might be of different types, and can lead to some unexpected behavior. Juggling Facts can be exploited by noticing that the switch statement in PHP uses a loose comparison, not a strict one. This video will cover all of this, and exploit type juggling to get the flag.

[00:00] Introduction
[00:27] Webpage enumeration
[02:19] Looking at source, starting with docker
[03:26] PHP source analysis
[04:15] getfacts endpoint
[05:39] Type juggling analysis
[08:08] Switch type juggling example in PHP terminal
[10:30] Get flag in Burp Repeater
Рекомендации по теме
Комментарии
Автор

I'm really enjoying your videos of all these challenges, you are doing a great job job explaining everything, I really like doing challenges and finding good videos or writeups is not as common as it's with machines

alphariusomegon
Автор

Awesome straight forward, quick, easy to understand videos! Hope you keep it up you're amazing.

InfoSecIntel